I do have to wonder though if everyone is so preoccupied with this bug, how vulnerable are they to a side attack? E.g. if North Korea launched some nukes towards the US, would anyone even notice?
Or only once the Twitter was down?
@Xander 14 so far myself, but there's been loads in other queueueueueues as well
Then they probably didn't really have a question at all, they're just seeking attention. We're not fame.se :P
I get it that many people have questions about heartbleed, but that doesn't mean that dupes shouldn't be closed as dupes, unclear with a request for clarification, and so on. What I don't get is that there's often nearly identical questions at the top of the list, and they're still being asked as new ones. Or that there's a perfectly good answer in the page they link to in their question, and didn't bother to read it. It just makes even more writing about it pointless., they'd have to read it.
Sure they should be closed. Downvoting them into oblivion, however, is just adding insult to injury.
Mind you, I'm not saying it shouldn't be downvoted. But it shouldn't happen from the queue - if you feel strongly enough to open the question separately to downvote it, the downvote is probably justified; and if you don't, well there you have it.
@FEichinger the point is that questions with 3 downvotes or more don't clutter the front page, and perhaps if they didn't there would be less needless duplication
it doesn't remove any rep on 1 rep users, if they get an upvote those previous downvotes don't even count
@FEichinger they might see existing questions with answers then, not the ones without
Anyway, I don't even downvote on dupes, so I'm not sure why I'm even saying this. Dupes are not that bad, they can help you find answers to already existing and nearly identical questions if the wording adds to the search keywords. But I do downvote poor questions, and we had many of those today.
Of course. But a question in the close queue isn't necessarily a bad question. :P
I suppose you could ask on MSO for votes to be re-enabled in the queue for questions with low-quality close votes.
(unclear/too broad/POB)
Then again, pile-on downvotes on SO are a problem.
They are part of what causes question bans. And as easy as it sounds in theory, "fixing" your past posts can be a problem when they've been rapidly deleted and flooded with downvotes for "being trivial".
@FEichinger OK, I get it that some SE sites have a different culture, but I don't really consider myself a serial downvoter, not when I have a fair amount more of upvotes at least. Votes should reflect quality (clarity, helpfulness, specificity,...) and that's what I try that mine reflect too. It's not my fault we got loads of crap today. Most of the days it's not like this at all. And yes, I even upvote some questions :P
@tylerl Switching platforms, trying to find/learn new apps, trying to learn the platform myself so I can help her when things go wrong... all to prevent something that hasn't happened (and probably won't happen again) in years? It's a little much.
I'm beginning to regret choosing a cut-price SSL reseller. I searched for "revoke" in their Knowledge base. I got back Fatal error: Class 'pagination' not found in /var/www/vhosts/sslhelpdesk.com/httpdocs/__swift/cache/90674b1a2f26615bd06ab00ceefcffd1.php on line 55
@ThomasPornin I'll concede #2 on the principle that using a sledgehammer to do anything looks awesome. Point 1 is debatable and probably even implementation-dependent. Either way, I think point 2 only works for Linux in movies anyway.
@Ladadadada From that file path, you can deduce that they're running Plesk. Which typically means they've got some RCE vuln somewhere. Maybe you can just log in and revoke it yourself.
@ThomasPornin Oh, no. My wife has awesome looks in general, absolutely. I just don't think she'd look very awesome in the specific case where she is trying to use Linux.
My risk analysis concludes to the idea that the effort involved in obtaining a new certificate is not commensurate with the risk of using a key which might have been potentially viewed as perhaps subject to partial exposure.
* Concerned about security enough to revoke certificate due to heartbleed risk * Unconcerned about security enough to buy certificates from a reseller running Plesk
@Iszi the OpenSSL team never struck me as the brightest crew. The software is functionally reasonably solid, but pretty much EVERYTHING else about the entire operation looks like it's run by an ADD teenager.
@Lucio We've got a lot of non-regulars today. @Ajasja, @NathanLucy, @NathanC, @OliverSalzburg, @Jacob, @Braiam, @FalconMomot, @ColinCassidy, @BarryCarlyon, @Bob, and @Eric are all fairly unfamiliar to me.
Background
I am using Linux Mint for one of my servers and have been trying to find out if the Linux Mint Debian Edition(LMDE) has updated their repositories with patches for the OpenSSL bug.
I have a different pure Debian server and Debian was quick to remedy the problem. However, after runni...
Is there any way to use a browser extension on Firefox or Chrome that shows whether a TLS session is vulnerable to HeartBleed (server uses openssl) and whether the certificate was issued prior to the publication of the issue?
@Xander I agree with the Linux kernel coding standard on this point -- keep the relevant code close together; don't use up whitespace unless you want to separate things.
No. You do not have to change all your passwords due to heartbleed. You have to change all your passwords because everybody seems to have become a huge herd of panicking sheep; changing your passwords will give you a warm feeling of doing something useful while you are running to your ultimate de...
Yes, you should always change all of your passwords.
You never know when someone might have compromised your password. And really without any certainty that it the worst hasn't happened today, the only sensible action is to take any and all measures possible to protect yourself.
The same goes f...
@AviD I put opening braces on the end of the line because the scarce resource I am trying to save on is vertical eye movement: I can "see" about 30 to 35 lines; more is tiring.
Though if you are a giant squid, I can understand that your eyes are up to ranging over a much longer set of lines.
I wrote a Metasploit module to test this, its currently being reviewed, but should hit the master branch relatively soon.
https://github.com/rapid7/metasploit-framework/pull/3212
Unlike the server-side attack, you have to implement most of TLS as the heartbeat reply is encrypted against the SSL...
@tylerl Yeah, that's pretty much it. Although we have four different certs from four different companies and when it comes time to renew this particular certificate I think it will be time to consolidate somewhere else.
So, speaking of that abominable topic; my examination suggests that it's far more likely that a server's certificate show up in a leak rather than the key.
People say that they've seen "ssl certificates" because of the HB attack. We assume that they meant "private keys", but perhaps they actually meant "public certificates".
the certificate actually gets loaded up in memory and delivered over the channel during handshaking. The key does not. It gets used, but that's slightly different.
You wouldn't expect to see -----BEGIN RSA PRIVATE KEY----- because that's not shuttled into ram for every connection.
@tylerl The private key could still possibly be loaded into RAM. As shown, one could execute the exploit as fast as they want to and get all sorts of data
Given an infinite number of chances, there's still a chance of the key being revealed - a very, very low chance, but it's not 0%.
@NathanC That's assuming that the key is ever at some point resident immediately following the response structure. Which may not actually happen. It's like saying that if you count the number of dogs in London an infinite number of times, you'll eventually get the answer pi.
Replication out to infinity doesn't automatically mean "I get whatever answer I choose".
"Excuse me Ms. Talbot, Can you please ask Andersen whether he has patched the bleeding X-hole? This could become a real problem if we let it sit overnight."
Take a look at this answer for technical PoCs and more details on what is exposed.
"not an answer" :))
Also, how many devices is he using on his vacation if he couldn't even bother to login to the same account he used before? He's into boat programming too? :D
Is there any way to use a browser extension on Firefox or Chrome that shows whether a TLS session is vulnerable to HeartBleed (server uses openssl) and whether the certificate was issued prior to the publication of the issue?
Yes, you should always change all of your passwords.
You never know when someone might have compromised your password. And really without any certainty that it the worst hasn't happened today, the only sensible action is to take any and all measures possible to protect yourself.
The same goes f...
I wrote a Metasploit module to test this, its currently being reviewed, but should hit the master branch relatively soon.
https://github.com/rapid7/metasploit-framework/pull/3212
Unlike the server-side attack, you have to implement most of TLS as the heartbeat reply is encrypted against the SSL...
